Correlations in RC6 with a Reduced Number of Rounds

In this paper the block cipher RC6 is analysed. RC6 is submitted as a candidate for the Advanced Encryption Standard, and is one of five finalists. It has 128-bit blocks and supports keys of 128, 192 and 256 bits, and is an iterated 20-round block cipher. Here it is shown that versions of RC6 with 128-bit blocks can be distinguished from a random permutation with up to 15 rounds; for some weak keys up to 17 rounds. Moreover, with an increased effort key-recovery attacks faster than exhaustive key search can be mounted on RC6 with up to 12 rounds for 128 bit keys, on 14 rounds for 192 bit keys and on 15 rounds for 256 bit keys.